Mouser, thanks very much for your fast and helpful reply! So the VM software has within it the ability to make these snapshots, rather than having to use something like Macrium Reflect or Acronis? If so, that's great.

More advanced users could use snapshots to keep different saved states, but by far the most common use of a snapshot, for people who use a virtual machine to test software, is:

You make a snapshot of the machine after you do the operating system install and after you have updated the operating system.

This is your base snapshot of your known trusted good machine.

Then when you want to test something you install it, test it, and then eventually REVERT to your base clean snapshot.

That is, you are always going back to your known trusted good clean snapshot after you finish a round of testing.

As has been pointed out by others, in theory a virtual machine is immune to attack by malware, but you should consider a few things before unleashing known malware in a virtual machine:

You have to be careful if your virtual machine is able to access the network -- especially because it may look to your real host computer and others on the network, as if the virtual machine is a "trusted" machine on your LAN. One nice feature of a virtual machine however is that you can DISABLE network connectivity with a simple option, thus locking down the machine from any network access.

You also have to worry about any SHARED FOLDERS that the virtual machine software may set up. A malware could infect such shared folders.

Lastly, there is always the possibility that a malware will be specifically coded to exploit bugs in a virtual machine software and "break out" of the virtual machine. This is not a purely theoretical concern -- I have read about virtual machine exploits -- though I don't have any idea how rare they are. But you should always be cautious about assuming that a virtual machine provides 100% secure testing environment for truly malicious malware.

Yes, you could consider a copy of a virtual machine like an image made by the software you mentioned.

Snapshots are a lot smaller in size and apparently restore fast (I only have experience with VMWare Player).

My way of working is always to configure/finetune a virtual machine, then make a copy of it, then compress it (7zip) for storage on DVD. A whole lot more personal involvement, but it doesn´t require money to be separated from your wallet.

If you think this is too much of a hassle, the VMWare Workstation software would be your best option. Likely once you tried it, you wonder how you could have managed without it all this time.

WMWare player does *not* have the snapshot ability, but simply copying the files seems to have worked fine - well, I haven't tried a "restore" yet -will only do so if thing screw up- but Ren says it works ;-)Copying when it's not running is better: it's a lot smaller -minus the page file I guess, and the restore should work better.

@cyberdiva, my experience so far:

it *is* easy

avoid nlite

I didnt have to load any drivers - in spite of installing the original XP (no service packs) that AFAIK normally needs SATA drivers before it will install

I made the virtual machine 100GB - I remember original XP having problems with terabyte drives

@CD - if you get a chance (and can spare about an hour) do try to watch some of Eli the Computer Guy's Introduction to Virtualization video I mentioned earlier. It's a very gentle, but not dumbed-down, introduction to virtualization technology. And one of the better instructional vids I've ever seen.

Lastly, there is always the possibility that a malware will be specifically coded to exploit bugs in a virtual machine software and "break out" of the virtual machine. This is not a purely theoretical concern -- I have read about virtual machine exploits -- though I don't have any idea how rare they are. But you should always be cautious about assuming that a virtual machine provides 100% secure testing environment for truly malicious malware.

First, the purpose of generic malware is to infect as many machines as possible, for botnet zombies or for harvesting passwords or CC data. There's not enough people running VMs that it makes sense putting VM-breakout exploits in a generic piece of malware. It's muuuuuuch more interesting to keep those exploits private, either to sell it to the highest bidder, or for doing your own very-targetted attacks.

As for snapshots vs. file-copying, snapshots are definitely prefarable, unless you're dealing with very small virtual drives, since snapshots don't copy the entire virtual disk image - instead, unless I've misunderstood things and the file sizes in my VM dirs , it "freezes" the previous image and stores modified blocks in a new file.

with VMWare Workstation, I'm looking at a cost of 177.68 euros = almost US$220. (That's including tax.)So I'll stick with the backup solution ;-)

I'm now using a backup programme that (after the initial backup) just backs up the modified blocks. I guess I could test it by restoring to a different folder and run it as a new VM. Maybe, sometime...

Even if you can use snapshots for testing, I agree with Renegade that it is a good idea to keep backup copies of any original "clean" VMs you create. In many ways, a VM is like another computer available to work on when needed, and you really don't want to lose it by accident.

A VM is like a disk image. The difference is that the operating system on it has been modified to require a virtual environment in which to run. In some cases, it is possible to convert an image of a real system to run in a VM, or to convert a VM to run a real system. I have used Paragon's virtual manager (part of their Hard Disk Manager Pro but also available separately), to restore a backup image of an older system to a VMware VM, allowing me to run programs that were installed on it even though I no longer have the original computer.

There are two things about VMWare Workstation I think worth mentioning:

1. There are two VM states: either its O/S is alive or has been shutdown. Creating a snapshot of the latter is much quicker and much smaller in size. That is because a VM snapshot of a running O/S will include its "memory" state. e.g. if you run WinXP in a VM which has been setup with a 1 GB memory, the state of that 1 GB memory is always included in a snapshot unless you shutdown that WinXP before creating a snpshot.

2. It is a great fun to play with VMWare snapshots, like playing solitaire a game.a) You can create multiple snapshots base on a parent snapshot.b) If a1, a2, a3, ... aN is a series of snapshots where aN is based on aN-1, you may delete a snapshot in the mid. e.g. you can delete a2 without hurting a3 and the rest of the snapshots which all originated from a2c) You can even edit and manipulate VM shnapshot file(s) (while it is not in use)...

@CD - if you get a chance (and can spare about an hour) do try to watch some of Eli the Computer Guy's Introduction to Virtualization video I mentioned earlier. It's a very gentle, but not dumbed-down, introduction to virtualization technology. And one of the better instructional vids I've ever seen.

Thanks very much, 40hz, for the recommendation. I watched the shorter video you mentioned earlier, about VirtualBox, and found it helpful. I've now started to watch the longer video you mention here, and it may turn out to be really useful, but I wish Eli had broken it into two parts, one dealing with type 1 hypervisors and one dealing with type 2. I found it somewhat tedious listening to him go on and on about type 1, knowing that I'd probably never use that. I finally realized that there was a contents list below the video, and I was able to bail out of the rest of the type 1 discussion and move on to type 2. But by then I was getting a bit antsy, so I stopped the video and did other things. I definitely will go back to it later today, however, and I'm very grateful to you for letting me know about it.

^Sorry! Should have warned you. Being in IT, it didn't really occur to me to tell you to skip forward. And yes he can repeat himself a bit. But part of that is the old school way of presenting tech info to a mixed audience, to wit:

First, tell them what you're gonna tell them. Next, tell them. Finally, tell them what you just told them.

Everybody hates it. But it does boost retention quite a bit (at least in males) doing it that way.

1. There are two VM states: either its O/S is alive or has been shutdown. Creating a snapshot of the latter is much quicker and much smaller in size. That is because a VM snapshot of a running O/S will include its "memory" state. e.g. if you run WinXP in a VM which has been setup with a 1 GB memory, the state of that 1 GB memory is always included in a snapshot unless you shutdown that WinXP before creating a snpshot.

I'm wondering, can I restore my backup to a different location and use it as a new virtual OS, or would it confuse VMWare because it's exactly the same as the other? I see I can open a virtual machine "which will then be added to your library"

I'm wondering, can I restore my backup to a different location and use it as a new virtual OS, or would it confuse VMWare because it's exactly the same as the other? I see I can open a virtual machine "which will then be added to your library"

If you make a copy of the VM files and open them, VMWare should ask you something to the effect of "is this a copy, or did you move the VM files?". It also does this after a reinstall (at least a full Windows reinstall, haven't reinstalled vmware on it's own).

I'm wondering, can I restore my backup to a different location and use it as a new virtual OS, or would it confuse VMWare because it's exactly the same as the other? I see I can open a virtual machine "which will then be added to your library"

If you make a copy of the VM files and open them, VMWare should ask you something to the effect of "is this a copy, or did you move the VM files?". It also does this after a reinstall (at least a full Windows reinstall, haven't reinstalled vmware on it's own).

Not that familiar with VMWare (I use MS's Virtual PC) but IIRC it does support USB, so yes it should be. Or if the printer used a parallel port it should be fine also. Network printers you can do anything you want with.

If a printer is enabled in the virtual OS, is it then disabled in the main machine?

Both VMware Workstation and VirtualBox have just released major updates.

VMware Workstation 9 is an expensive ($119) upgrade barely a year after version 8 was released. It appears to bring some interesting new options, such as the ability to access a VM remotely or to mount a virtual disk as a drive on the host system, but it's getting harder to justify the cost versus the free (at least for personal use) of VirtualBox 4.2.